CVE-2023-6501
Splashscreen <= 0.20 - Settings Update via CSRF
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The Splashscreen WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
El complemento Splashscreen de WordPress hasta la versión 0.20 no tiene activada la verificación CSRF al actualizar su configuración, lo que podría permitir a los atacantes hacer que un administrador que haya iniciado sesión los cambie mediante un ataque CSRF.
The Splashscreen plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 0.20. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to update the plugin's settings granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2023-12-04 CVE Reserved
- 2024-01-19 CVE Published
- 2024-10-10 EPSS Updated
- 2024-10-28 CVE Updated
- 2024-10-28 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://magos-securitas.com/txt/CVE-2023-6501.txt |
| URL | Date | SRC |
|---|---|---|
| https://wpscan.com/vulnerability/dd19189b-de04-44b6-8ac9-0c32399a8976 | 2024-10-28 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Unknown Search vendor "Unknown" | Splashscreen Search vendor "Unknown" for product "Splashscreen" | <= 0.20 Search vendor "Unknown" for product "Splashscreen" and version " <= 0.20" | en |
Affected
| ||||||